CleanSight combines five data layers to construct attack paths. The scan you exported gives us layers 1 + 2 directly; layers 3-5 are inferred from your AWS ECS architecture pattern. A live CleanSight deployment with read access to the AWS account would populate them from AWS APIs.
Layer 1 · SBOM intelligence
Which packages live in which image, which Docker layer introduced them, which CVEs apply to each version.
scan-derived
Layer 2 · Threat intel context
CISA KEV (actively exploited), FIRST.org EPSS (probability of exploitation), CVSS. Decides which CVEs are weaponised vs. theoretical.
CISA KEV + FIRST EPSS · live
Layer 3 · Runtime topology
Which images run as ECS Tasks in which cluster, with which IAM Task Role, which can reach which downstream services.
inferred · ECS API would populate
Layer 4 · Network exposure
Which Target Groups sit behind public ALBs, which have AWS WAF in front, Security Group rules and VPC reachability.
inferred · AWS ELB + EC2 API
Layer 5 · Tricorder anomaly
Runtime behavioural signal: unexpected outbound calls, suspicious package metadata. Amplifies risk when active anomaly + exploitable CVE co-occur.
CleanStart Tricorder
Risk scoring
Attack path risk = EPSS × reachability × network exposure × lateral hops × anomaly. Paths ranked by exploitability, not raw CVE count.
CleanSight risk engine
